SECUFOCUSNOW
Home›CVE index›CVE-2026-31407
Review reviewHigh

CVE-2026-31407

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-b...

CVSS
7.1
EPSS
0.17%
6.55% percentile
CISA KEV
Not listed
Published
2026.04.06
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.17%
Technical severityCVSS 7.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-b...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < e7b5766693477c52424cc6c79dd30a7a9c7db52c, >= a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < 78bba9f73942aa7dca47d817d8cec0fb9b443b70, >= a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < be88a337bf07afb1ee173f1099294d1b7ab3fefe, >= a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < c5e918390002edf0cff80a0e7ce1f86f16a9507c, >= a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < 9174d28f3f15d8c4962f5980c0be167633880443, >= a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < 67c53c1978cef3c504237275e39c857e2f6af56e, >= a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < 0fbae1e74493d5a160a70c51aeba035d8266ea7d, >= a258860e01b80e8f554a4ab1a6c95e6042eb8b73 < f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05, >= 2.6.27, >= 2.6.27 < 6.6.136, >= 6.7 < 6.12.83, >= 6.13 < 6.18.24, >= 6.19 < 6.19.10, 7.0
Fixed versions
6.6.136, 6.12.83, 6.18.24, 6.19.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE
CWE-787
CVE-2026-31407 — Linux Linux, linux kernel | SECUFOCUS NOW